Faculty in The University of Tulsa’s School of Cyber Studies were awarded $600,000 in funding over three years from the U.S. National Science Foundation (NSF) to expand our understanding of systemic risk of cyberattacks through the U.S.
Tandy Endowed Chair Tyler Moore, Ph.D.; Research Assistant Professor Andrew Morin, Ph.D.; and Applied Distinguished Professor Neil Gandal, Ph.D., may be the first to quantify systemic cyber risk throughout the U.S. economy in an academic research project.
The project, titled “Security, Privacy, and Trust in Cyberspace (SaTC): CORE: Small: Measuring Systemic Cyber Risk,” aims to empirically define and measure systemic cyber risk across industries. By initially evaluating firm- and product-level risk, the faculty can later measure how these risks may spread to organizations using identical or similar products.
The professors have already identified one such case. The most widely used commercial routers in the economy showcases the potential scale of this issue. A serious vulnerability in the widely used router posed a systemic cyber risk to many firms.
“Much of the data necessary for the identification of systemic cyber risk is sparsely available and inconsistently reported,” said Morin. “In preparation for this research, we have compiled a rich dataset including hardware, software, and their associated vulnerabilities for individual organizations. This allows us to identify the risk profiles of firms based on their product usage and how a successful exploit might propagate across firms with similar risk profiles.”
“They held more than 50% of the overall router market in 2022 and exceeded 60% within several individual industries,” continued Morin. “We found a significant correlation between the number of vulnerabilities and their market share.”
The project will develop methods for measuring systemic risk, including how many industries and companies use specific products, as well as the number of associated vulnerabilities and their potential impact.
“The ability for organizations to measure their risk exposure and make informed decisions about hardware and software products will decrease overall systemic cyber risk across industries,” said Morin. “Furthermore, cyber insurers will be better equipped to measure and quantify correlated cyber risk.”
Research project completion will provide understanding among cyber studies and society, such as within our government and the national infrastructure. It could also aid in the creation of a new cyber insurance market measure qualifying data from cyber risks.
The results of this project will be taught in the university’s cyber studies economic concentration. This will allow present and future students in the College of Engineering & Computer Science to further disseminate this pioneering research. Opportunities such as these are part of UTulsa’s legacy of research, collaboration, and innovation.